639 lines
22 KiB
Go
639 lines
22 KiB
Go
|
// Copyright (c) HashiCorp, Inc.
|
||
|
|
// SPDX-License-Identifier: MPL-2.0
|
||
|
|
|
||
|
|
package pkiext
|
||
|
|
|
||
|
|
import (
|
||
|
|
"context"
|
||
|
|
"crypto/tls"
|
||
|
|
"crypto/x509"
|
||
|
|
"fmt"
|
||
|
|
"io"
|
||
|
|
"net"
|
||
|
|
"net/http"
|
||
|
|
"strconv"
|
||
|
|
"strings"
|
||
|
|
"sync"
|
||
|
|
"testing"
|
||
|
|
"time"
|
||
|
|
|
||
|
|
"github.com/hashicorp/go-uuid"
|
||
|
|
"github.com/hashicorp/vault/builtin/logical/pki"
|
||
|
|
"github.com/hashicorp/vault/sdk/helper/docker"
|
||
|
|
"github.com/stretchr/testify/require"
|
||
|
|
)
|
||
|
|
|
||
|
|
var (
|
||
|
|
cwRunner *docker.Runner
|
||
|
|
builtNetwork string
|
||
|
|
buildClientContainerOnce sync.Once
|
||
|
|
)
|
||
|
|
|
||
|
|
const (
|
||
|
|
protectedFile = `dadgarcorp-internal-protected`
|
||
|
|
unprotectedFile = `hello-world`
|
||
|
|
failureIndicator = `THIS-TEST-SHOULD-FAIL`
|
||
|
|
uniqueHostname = `dadgarcorpvaultpkitestingnginxwgetcurlcontainersexample.com`
|
||
|
|
containerName = `vault_pki_nginx_integration`
|
||
|
|
)
|
||
|
|
|
||
|
|
func buildNginxContainer(t *testing.T, root string, crl string, chain string, private string) (func(), string, int, string, string, int) {
|
||
|
|
containerfile := `
|
||
|
|
FROM nginx:latest
|
||
|
|
|
||
|
|
RUN mkdir /www /etc/nginx/ssl && rm /etc/nginx/conf.d/*.conf
|
||
|
|
|
||
|
|
COPY testing.conf /etc/nginx/conf.d/
|
||
|
|
COPY root.pem /etc/nginx/ssl/root.pem
|
||
|
|
COPY fullchain.pem /etc/nginx/ssl/fullchain.pem
|
||
|
|
COPY privkey.pem /etc/nginx/ssl/privkey.pem
|
||
|
|
COPY crl.pem /etc/nginx/ssl/crl.pem
|
||
|
|
COPY /data /www/data
|
||
|
|
`
|
||
|
|
|
||
|
|
siteConfig := `
|
||
|
|
server {
|
||
|
|
listen 80;
|
||
|
|
listen [::]:80;
|
||
|
|
|
||
|
|
location / {
|
||
|
|
return 301 $request_uri;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
server {
|
||
|
|
listen 443 ssl;
|
||
|
|
listen [::]:443 ssl;
|
||
|
|
|
||
|
|
ssl_certificate /etc/nginx/ssl/fullchain.pem;
|
||
|
|
ssl_certificate_key /etc/nginx/ssl/privkey.pem;
|
||
|
|
|
||
|
|
ssl_client_certificate /etc/nginx/ssl/root.pem;
|
||
|
|
ssl_crl /etc/nginx/ssl/crl.pem;
|
||
|
|
ssl_verify_client optional;
|
||
|
|
|
||
|
|
# Magic per: https://serverfault.com/questions/891603/nginx-reverse-proxy-with-optional-ssl-client-authentication
|
||
|
|
# Only necessary since we're too lazy to setup two different subdomains.
|
||
|
|
set $ssl_status 'open';
|
||
|
|
if ($request_uri ~ protected) {
|
||
|
|
set $ssl_status 'closed';
|
||
|
|
}
|
||
|
|
|
||
|
|
if ($ssl_client_verify != SUCCESS) {
|
||
|
|
set $ssl_status "$ssl_status-fail";
|
||
|
|
}
|
||
|
|
|
||
|
|
if ($ssl_status = "closed-fail") {
|
||
|
|
return 403;
|
||
|
|
}
|
||
|
|
|
||
|
|
location / {
|
||
|
|
root /www/data;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
`
|
||
|
|
|
||
|
|
bCtx := docker.NewBuildContext()
|
||
|
|
bCtx["testing.conf"] = docker.PathContentsFromString(siteConfig)
|
||
|
|
bCtx["root.pem"] = docker.PathContentsFromString(root)
|
||
|
|
bCtx["fullchain.pem"] = docker.PathContentsFromString(chain)
|
||
|
|
bCtx["privkey.pem"] = docker.PathContentsFromString(private)
|
||
|
|
bCtx["crl.pem"] = docker.PathContentsFromString(crl)
|
||
|
|
bCtx["/data/index.html"] = docker.PathContentsFromString(unprotectedFile)
|
||
|
|
bCtx["/data/protected.html"] = docker.PathContentsFromString(protectedFile)
|
||
|
|
|
||
|
|
imageName := "vault_pki_nginx_integration"
|
||
|
|
suffix, err := uuid.GenerateUUID()
|
||
|
|
if err != nil {
|
||
|
|
t.Fatalf("error generating unique suffix: %v", err)
|
||
|
|
}
|
||
|
|
imageTag := suffix
|
||
|
|
|
||
|
|
runner, err := docker.NewServiceRunner(docker.RunOptions{
|
||
|
|
ImageRepo: imageName,
|
||
|
|
ImageTag: imageTag,
|
||
|
|
ContainerName: containerName,
|
||
|
|
Ports: []string{"443/tcp"},
|
||
|
|
LogConsumer: func(s string) {
|
||
|
|
if t.Failed() {
|
||
|
|
t.Logf("container logs: %s", s)
|
||
|
|
}
|
||
|
|
},
|
||
|
|
})
|
||
|
|
if err != nil {
|
||
|
|
t.Fatalf("Could not provision docker service runner: %s", err)
|
||
|
|
}
|
||
|
|
|
||
|
|
ctx := context.Background()
|
||
|
|
output, err := runner.BuildImage(ctx, containerfile, bCtx,
|
||
|
|
docker.BuildRemove(true), docker.BuildForceRemove(true),
|
||
|
|
docker.BuildPullParent(true),
|
||
|
|
docker.BuildTags([]string{imageName + ":" + imageTag}))
|
||
|
|
if err != nil {
|
||
|
|
t.Fatalf("Could not build new image: %v", err)
|
||
|
|
}
|
||
|
|
|
||
|
|
t.Logf("Image build output: %v", string(output))
|
||
|
|
|
||
|
|
svc, err := runner.StartService(ctx, func(ctx context.Context, host string, port int) (docker.ServiceConfig, error) {
|
||
|
|
// Nginx loads fast, we're too lazy to validate this properly.
|
||
|
|
time.Sleep(5 * time.Second)
|
||
|
|
return docker.NewServiceHostPort(host, port), nil
|
||
|
|
})
|
||
|
|
if err != nil {
|
||
|
|
t.Fatalf("Could not start nginx container: %v", err)
|
||
|
|
}
|
||
|
|
|
||
|
|
// We also need to find the network address of this node, and return
|
||
|
|
// the non-local address associated with it so that we can spawn the
|
||
|
|
// client command on the correct network/port.
|
||
|
|
networks, err := runner.GetNetworkAndAddresses(svc.Container.ID)
|
||
|
|
if err != nil {
|
||
|
|
t.Fatalf("Could not interrogate container for addresses: %v", err)
|
||
|
|
}
|
||
|
|
|
||
|
|
var networkName string
|
||
|
|
var networkAddr string
|
||
|
|
for name, addr := range networks {
|
||
|
|
if addr == "" {
|
||
|
|
continue
|
||
|
|
}
|
||
|
|
|
||
|
|
networkName = name
|
||
|
|
networkAddr = addr
|
||
|
|
break
|
||
|
|
}
|
||
|
|
|
||
|
|
if networkName == "" || networkAddr == "" {
|
||
|
|
t.Fatalf("failed to get network info for containers: empty network address: %v", networks)
|
||
|
|
}
|
||
|
|
|
||
|
|
pieces := strings.Split(svc.Config.Address(), ":")
|
||
|
|
port, _ := strconv.Atoi(pieces[1])
|
||
|
|
return svc.Cleanup, pieces[0], port, networkName, networkAddr, 443
|
||
|
|
}
|
||
|
|
|
||
|
|
func buildWgetCurlContainer(t *testing.T, network string) {
|
||
|
|
containerfile := `
|
||
|
|
FROM ubuntu:latest
|
||
|
|
|
||
|
|
RUN apt update && DEBIAN_FRONTEND="noninteractive" apt install -y curl wget wget2
|
||
|
|
`
|
||
|
|
|
||
|
|
bCtx := docker.NewBuildContext()
|
||
|
|
|
||
|
|
imageName := "vault_pki_wget_curl_integration"
|
||
|
|
imageTag := "latest"
|
||
|
|
|
||
|
|
var err error
|
||
|
|
cwRunner, err = docker.NewServiceRunner(docker.RunOptions{
|
||
|
|
ImageRepo: imageName,
|
||
|
|
ImageTag: imageTag,
|
||
|
|
ContainerName: "vault_pki_wget_curl",
|
||
|
|
NetworkID: network,
|
||
|
|
// We want to run sleep in the background so we're not stuck waiting
|
||
|
|
// for the default ubuntu container's shell to prompt for input.
|
||
|
|
Entrypoint: []string{"sleep", "45"},
|
||
|
|
LogConsumer: func(s string) {
|
||
|
|
if t.Failed() {
|
||
|
|
t.Logf("container logs: %s", s)
|
||
|
|
}
|
||
|
|
},
|
||
|
|
})
|
||
|
|
if err != nil {
|
||
|
|
t.Fatalf("Could not provision docker service runner: %s", err)
|
||
|
|
}
|
||
|
|
|
||
|
|
ctx := context.Background()
|
||
|
|
output, err := cwRunner.BuildImage(ctx, containerfile, bCtx,
|
||
|
|
docker.BuildRemove(true), docker.BuildForceRemove(true),
|
||
|
|
docker.BuildPullParent(true),
|
||
|
|
docker.BuildTags([]string{imageName + ":" + imageTag}))
|
||
|
|
if err != nil {
|
||
|
|
t.Fatalf("Could not build new image: %v", err)
|
||
|
|
}
|
||
|
|
|
||
|
|
t.Logf("Image build output: %v", string(output))
|
||
|
|
}
|
||
|
|
|
||
|
|
func CheckWithClients(t *testing.T, network string, address string, url string, rootCert string, certificate string, privatekey string) {
|
||
|
|
// We assume the network doesn't change once assigned.
|
||
|
|
buildClientContainerOnce.Do(func() {
|
||
|
|
buildWgetCurlContainer(t, network)
|
||
|
|
builtNetwork = network
|
||
|
|
})
|
||
|
|
|
||
|
|
if builtNetwork != network {
|
||
|
|
t.Fatalf("failed assumption check: different built network (%v) vs run network (%v); must've changed while running tests", builtNetwork, network)
|
||
|
|
}
|
||
|
|
|
||
|
|
// Start our service with a random name to not conflict with other
|
||
|
|
// threads.
|
||
|
|
ctx := context.Background()
|
||
|
|
result, err := cwRunner.Start(ctx, true, false)
|
||
|
|
if err != nil {
|
||
|
|
t.Fatalf("Could not start golang container for wget/curl checks: %s", err)
|
||
|
|
}
|
||
|
|
|
||
|
|
// Commands to run after potentially writing the certificate. We
|
||
|
|
// might augment these if the certificate exists.
|
||
|
|
//
|
||
|
|
// We manually add the expected hostname to the local hosts file
|
||
|
|
// to avoid resolving it over the network and instead resolving it
|
||
|
|
// to this other container we just started (potentially in parallel
|
||
|
|
// with other containers).
|
||
|
|
hostPrimeCmd := []string{"sh", "-c", "echo '" + address + " " + uniqueHostname + "' >> /etc/hosts"}
|
||
|
|
wgetCmd := []string{"wget", "--verbose", "--ca-certificate=/root.pem", url}
|
||
|
|
curlCmd := []string{"curl", "--verbose", "--cacert", "/root.pem", url}
|
||
|
|
|
||
|
|
certCtx := docker.NewBuildContext()
|
||
|
|
certCtx["root.pem"] = docker.PathContentsFromString(rootCert)
|
||
|
|
if certificate != "" {
|
||
|
|
// Copy the cert into the newly running container.
|
||
|
|
certCtx["client-cert.pem"] = docker.PathContentsFromString(certificate)
|
||
|
|
certCtx["client-privkey.pem"] = docker.PathContentsFromString(privatekey)
|
||
|
|
|
||
|
|
wgetCmd = []string{"wget", "--verbose", "--ca-certificate=/root.pem", "--certificate=/client-cert.pem", "--private-key=/client-privkey.pem", url}
|
||
|
|
curlCmd = []string{"curl", "--verbose", "--cacert", "/root.pem", "--cert", "/client-cert.pem", "--key", "/client-privkey.pem", url}
|
||
|
|
}
|
||
|
|
if err := cwRunner.CopyTo(result.Container.ID, "/", certCtx); err != nil {
|
||
|
|
t.Fatalf("Could not copy certificate and key into container: %v", err)
|
||
|
|
}
|
||
|
|
|
||
|
|
for _, cmd := range [][]string{hostPrimeCmd, wgetCmd, curlCmd} {
|
||
|
|
t.Logf("Running client connection command: %v", cmd)
|
||
|
|
|
||
|
|
stdout, stderr, retcode, err := cwRunner.RunCmdWithOutput(ctx, result.Container.ID, cmd)
|
||
|
|
if err != nil {
|
||
|
|
t.Fatalf("Could not run command (%v) in container: %v", cmd, err)
|
||
|
|
}
|
||
|
|
|
||
|
|
if len(stderr) != 0 {
|
||
|
|
t.Logf("Got stderr from command (%v):\n%v\n", cmd, string(stderr))
|
||
|
|
}
|
||
|
|
|
||
|
|
if retcode != 0 {
|
||
|
|
t.Logf("Got stdout from command (%v):\n%v\n", cmd, string(stdout))
|
||
|
|
t.Fatalf("Got unexpected non-zero retcode from command (%v): %v\n", cmd, retcode)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func CheckDeltaCRL(t *testing.T, network string, address string, url string, rootCert string, crls string) {
|
||
|
|
// We assume the network doesn't change once assigned.
|
||
|
|
buildClientContainerOnce.Do(func() {
|
||
|
|
buildWgetCurlContainer(t, network)
|
||
|
|
builtNetwork = network
|
||
|
|
})
|
||
|
|
|
||
|
|
if builtNetwork != network {
|
||
|
|
t.Fatalf("failed assumption check: different built network (%v) vs run network (%v); must've changed while running tests", builtNetwork, network)
|
||
|
|
}
|
||
|
|
|
||
|
|
// Start our service with a random name to not conflict with other
|
||
|
|
// threads.
|
||
|
|
ctx := context.Background()
|
||
|
|
result, err := cwRunner.Start(ctx, true, false)
|
||
|
|
if err != nil {
|
||
|
|
t.Fatalf("Could not start golang container for wget2 delta CRL checks: %s", err)
|
||
|
|
}
|
||
|
|
|
||
|
|
// Commands to run after potentially writing the certificate. We
|
||
|
|
// might augment these if the certificate exists.
|
||
|
|
//
|
||
|
|
// We manually add the expected hostname to the local hosts file
|
||
|
|
// to avoid resolving it over the network and instead resolving it
|
||
|
|
// to this other container we just started (potentially in parallel
|
||
|
|
// with other containers).
|
||
|
|
hostPrimeCmd := []string{"sh", "-c", "echo '" + address + " " + uniqueHostname + "' >> /etc/hosts"}
|
||
|
|
wgetCmd := []string{"wget2", "--verbose", "--ca-certificate=/root.pem", "--crl-file=/crls.pem", url}
|
||
|
|
|
||
|
|
certCtx := docker.NewBuildContext()
|
||
|
|
certCtx["root.pem"] = docker.PathContentsFromString(rootCert)
|
||
|
|
certCtx["crls.pem"] = docker.PathContentsFromString(crls)
|
||
|
|
if err := cwRunner.CopyTo(result.Container.ID, "/", certCtx); err != nil {
|
||
|
|
t.Fatalf("Could not copy certificate and key into container: %v", err)
|
||
|
|
}
|
||
|
|
|
||
|
|
for index, cmd := range [][]string{hostPrimeCmd, wgetCmd} {
|
||
|
|
t.Logf("Running client connection command: %v", cmd)
|
||
|
|
|
||
|
|
stdout, stderr, retcode, err := cwRunner.RunCmdWithOutput(ctx, result.Container.ID, cmd)
|
||
|
|
if err != nil {
|
||
|
|
t.Fatalf("Could not run command (%v) in container: %v", cmd, err)
|
||
|
|
}
|
||
|
|
|
||
|
|
if len(stderr) != 0 {
|
||
|
|
t.Logf("Got stderr from command (%v):\n%v\n", cmd, string(stderr))
|
||
|
|
}
|
||
|
|
|
||
|
|
if retcode != 0 && index == 0 {
|
||
|
|
t.Logf("Got stdout from command (%v):\n%v\n", cmd, string(stdout))
|
||
|
|
t.Fatalf("Got unexpected non-zero retcode from command (%v): %v\n", cmd, retcode)
|
||
|
|
}
|
||
|
|
|
||
|
|
if retcode == 0 && index == 1 {
|
||
|
|
t.Logf("Got stdout from command (%v):\n%v\n", cmd, string(stdout))
|
||
|
|
t.Fatalf("Got unexpected zero retcode from command; wanted this to fail (%v): %v\n", cmd, retcode)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func CheckWithGo(t *testing.T, rootCert string, clientCert string, clientChain []string, clientKey string, host string, port int, networkAddr string, networkPort int, url string, expected string, shouldFail bool) {
|
||
|
|
// Ensure we can connect with Go.
|
||
|
|
pool := x509.NewCertPool()
|
||
|
|
pool.AppendCertsFromPEM([]byte(rootCert))
|
||
|
|
tlsConfig := &tls.Config{
|
||
|
|
RootCAs: pool,
|
||
|
|
}
|
||
|
|
|
||
|
|
if clientCert != "" {
|
||
|
|
var clientTLSCert tls.Certificate
|
||
|
|
clientTLSCert.Certificate = append(clientTLSCert.Certificate, parseCert(t, clientCert).Raw)
|
||
|
|
clientTLSCert.PrivateKey = parseKey(t, clientKey)
|
||
|
|
for _, cert := range clientChain {
|
||
|
|
clientTLSCert.Certificate = append(clientTLSCert.Certificate, parseCert(t, cert).Raw)
|
||
|
|
}
|
||
|
|
|
||
|
|
tlsConfig.Certificates = append(tlsConfig.Certificates, clientTLSCert)
|
||
|
|
}
|
||
|
|
|
||
|
|
dialer := &net.Dialer{
|
||
|
|
Timeout: 30 * time.Second,
|
||
|
|
KeepAlive: 30 * time.Second,
|
||
|
|
}
|
||
|
|
|
||
|
|
transport := &http.Transport{
|
||
|
|
TLSClientConfig: tlsConfig,
|
||
|
|
DialContext: func(ctx context.Context, network, addr string) (net.Conn, error) {
|
||
|
|
if addr == host+":"+strconv.Itoa(port) {
|
||
|
|
// If we can't resolve our hostname, try
|
||
|
|
// accessing it via the docker protocol
|
||
|
|
// instead of via the returned service
|
||
|
|
// address.
|
||
|
|
if _, err := net.LookupHost(host); err != nil && strings.Contains(err.Error(), "no such host") {
|
||
|
|
addr = networkAddr + ":" + strconv.Itoa(networkPort)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return dialer.DialContext(ctx, network, addr)
|
||
|
|
},
|
||
|
|
}
|
||
|
|
|
||
|
|
client := &http.Client{Transport: transport}
|
||
|
|
clientResp, err := client.Get(url)
|
||
|
|
if err != nil {
|
||
|
|
if shouldFail {
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
t.Fatalf("failed to fetch url (%v): %v", url, err)
|
||
|
|
} else if shouldFail {
|
||
|
|
if clientResp.StatusCode == 200 {
|
||
|
|
t.Fatalf("expected failure to fetch url (%v): got response: %v", url, clientResp)
|
||
|
|
}
|
||
|
|
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
defer clientResp.Body.Close()
|
||
|
|
body, err := io.ReadAll(clientResp.Body)
|
||
|
|
if err != nil {
|
||
|
|
t.Fatalf("failed to get read response body: %v", err)
|
||
|
|
}
|
||
|
|
if !strings.Contains(string(body), expected) {
|
||
|
|
t.Fatalf("expected body to contain (%v) but was:\n%v", expected, string(body))
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func RunNginxRootTest(t *testing.T, caKeyType string, caKeyBits int, caUsePSS bool, roleKeyType string, roleKeyBits int, roleUsePSS bool) {
|
||
|
|
t.Skipf("flaky in CI")
|
||
|
|
|
||
|
|
b, s := pki.CreateBackendWithStorage(t)
|
||
|
|
|
||
|
|
testSuffix := fmt.Sprintf(" - %v %v %v - %v %v %v", caKeyType, caKeyType, caUsePSS, roleKeyType, roleKeyBits, roleUsePSS)
|
||
|
|
|
||
|
|
// Configure our mount to use auto-rotate, even though we don't have
|
||
|
|
// a periodic func.
|
||
|
|
_, err := pki.CBWrite(b, s, "config/crl", map[string]interface{}{
|
||
|
|
"auto_rebuild": true,
|
||
|
|
"enable_delta": true,
|
||
|
|
})
|
||
|
|
|
||
|
|
// Create a root and intermediate, setting the intermediate as default.
|
||
|
|
resp, err := pki.CBWrite(b, s, "root/generate/internal", map[string]interface{}{
|
||
|
|
"common_name": "Root X1" + testSuffix,
|
||
|
|
"country": "US",
|
||
|
|
"organization": "Dadgarcorp",
|
||
|
|
"ou": "QA",
|
||
|
|
"key_type": caKeyType,
|
||
|
|
"key_bits": caKeyBits,
|
||
|
|
"use_pss": caUsePSS,
|
||
|
|
"issuer_name": "root",
|
||
|
|
})
|
||
|
|
requireSuccessNonNilResponse(t, resp, err, "failed to create root cert")
|
||
|
|
rootCert := resp.Data["certificate"].(string)
|
||
|
|
resp, err = pki.CBWrite(b, s, "intermediate/generate/internal", map[string]interface{}{
|
||
|
|
"common_name": "Intermediate I1" + testSuffix,
|
||
|
|
"country": "US",
|
||
|
|
"organization": "Dadgarcorp",
|
||
|
|
"ou": "QA",
|
||
|
|
"key_type": caKeyType,
|
||
|
|
"key_bits": caKeyBits,
|
||
|
|
"use_pss": caUsePSS,
|
||
|
|
})
|
||
|
|
requireSuccessNonNilResponse(t, resp, err, "failed to create intermediate csr")
|
||
|
|
resp, err = pki.CBWrite(b, s, "issuer/default/sign-intermediate", map[string]interface{}{
|
||
|
|
"common_name": "Intermediate I1",
|
||
|
|
"country": "US",
|
||
|
|
"organization": "Dadgarcorp",
|
||
|
|
"ou": "QA",
|
||
|
|
"key_type": caKeyType,
|
||
|
|
"csr": resp.Data["csr"],
|
||
|
|
})
|
||
|
|
requireSuccessNonNilResponse(t, resp, err, "failed to sign intermediate csr")
|
||
|
|
intCert := resp.Data["certificate"].(string)
|
||
|
|
resp, err = pki.CBWrite(b, s, "issuers/import/bundle", map[string]interface{}{
|
||
|
|
"pem_bundle": intCert,
|
||
|
|
})
|
||
|
|
requireSuccessNonNilResponse(t, resp, err, "failed to sign intermediate csr")
|
||
|
|
_, err = pki.CBWrite(b, s, "config/issuers", map[string]interface{}{
|
||
|
|
"default": resp.Data["imported_issuers"].([]string)[0],
|
||
|
|
})
|
||
|
|
|
||
|
|
// Create a role+certificate valid for localhost only.
|
||
|
|
_, err = pki.CBWrite(b, s, "roles/testing", map[string]interface{}{
|
||
|
|
"allow_any_name": true,
|
||
|
|
"key_type": roleKeyType,
|
||
|
|
"key_bits": roleKeyBits,
|
||
|
|
"use_pss": roleUsePSS,
|
||
|
|
"ttl": "60m",
|
||
|
|
})
|
||
|
|
require.NoError(t, err)
|
||
|
|
resp, err = pki.CBWrite(b, s, "issue/testing", map[string]interface{}{
|
||
|
|
"common_name": uniqueHostname,
|
||
|
|
"ip_sans": "127.0.0.1,::1",
|
||
|
|
"sans": uniqueHostname + ",localhost,localhost4,localhost6,localhost.localdomain",
|
||
|
|
})
|
||
|
|
requireSuccessNonNilResponse(t, resp, err, "failed to create server leaf cert")
|
||
|
|
leafCert := resp.Data["certificate"].(string)
|
||
|
|
leafPrivateKey := resp.Data["private_key"].(string) + "\n"
|
||
|
|
fullChain := leafCert + "\n"
|
||
|
|
for _, cert := range resp.Data["ca_chain"].([]string) {
|
||
|
|
fullChain += cert + "\n"
|
||
|
|
}
|
||
|
|
|
||
|
|
// Issue a client leaf certificate.
|
||
|
|
resp, err = pki.CBWrite(b, s, "issue/testing", map[string]interface{}{
|
||
|
|
"common_name": "testing.client.dadgarcorp.com",
|
||
|
|
})
|
||
|
|
requireSuccessNonNilResponse(t, resp, err, "failed to create client leaf cert")
|
||
|
|
clientCert := resp.Data["certificate"].(string)
|
||
|
|
clientKey := resp.Data["private_key"].(string) + "\n"
|
||
|
|
clientWireChain := clientCert + "\n" + resp.Data["issuing_ca"].(string) + "\n"
|
||
|
|
clientTrustChain := resp.Data["issuing_ca"].(string) + "\n" + rootCert + "\n"
|
||
|
|
clientCAChain := resp.Data["ca_chain"].([]string)
|
||
|
|
|
||
|
|
// Issue a client leaf cert and revoke it, placing it on the main CRL
|
||
|
|
// via rotation.
|
||
|
|
resp, err = pki.CBWrite(b, s, "issue/testing", map[string]interface{}{
|
||
|
|
"common_name": "revoked-crl.client.dadgarcorp.com",
|
||
|
|
})
|
||
|
|
requireSuccessNonNilResponse(t, resp, err, "failed to create revoked client leaf cert")
|
||
|
|
revokedCert := resp.Data["certificate"].(string)
|
||
|
|
revokedKey := resp.Data["private_key"].(string) + "\n"
|
||
|
|
// revokedFullChain := revokedCert + "\n" + resp.Data["issuing_ca"].(string) + "\n"
|
||
|
|
// revokedTrustChain := resp.Data["issuing_ca"].(string) + "\n" + rootCert + "\n"
|
||
|
|
revokedCAChain := resp.Data["ca_chain"].([]string)
|
||
|
|
_, err = pki.CBWrite(b, s, "revoke", map[string]interface{}{
|
||
|
|
"certificate": revokedCert,
|
||
|
|
})
|
||
|
|
require.NoError(t, err)
|
||
|
|
_, err = pki.CBRead(b, s, "crl/rotate")
|
||
|
|
require.NoError(t, err)
|
||
|
|
|
||
|
|
// Issue a client leaf cert and revoke it, placing it on the delta CRL
|
||
|
|
// via rotation.
|
||
|
|
/*resp, err = pki.CBWrite(b, s, "issue/testing", map[string]interface{}{
|
||
|
|
"common_name": "revoked-delta-crl.client.dadgarcorp.com",
|
||
|
|
})
|
||
|
|
requireSuccessNonNilResponse(t, resp, err, "failed to create delta CRL revoked client leaf cert")
|
||
|
|
deltaCert := resp.Data["certificate"].(string)
|
||
|
|
deltaKey := resp.Data["private_key"].(string) + "\n"
|
||
|
|
//deltaFullChain := deltaCert + "\n" + resp.Data["issuing_ca"].(string) + "\n"
|
||
|
|
//deltaTrustChain := resp.Data["issuing_ca"].(string) + "\n" + rootCert + "\n"
|
||
|
|
deltaCAChain := resp.Data["ca_chain"].([]string)
|
||
|
|
_, err = pki.CBWrite(b, s, "revoke", map[string]interface{}{
|
||
|
|
"certificate": deltaCert,
|
||
|
|
})
|
||
|
|
require.NoError(t, err)
|
||
|
|
_, err = pki.CBRead(b, s, "crl/rotate-delta")
|
||
|
|
require.NoError(t, err)*/
|
||
|
|
|
||
|
|
// Get the CRL and Delta CRLs.
|
||
|
|
resp, err = pki.CBRead(b, s, "issuer/root/crl")
|
||
|
|
require.NoError(t, err)
|
||
|
|
rootCRL := resp.Data["crl"].(string) + "\n"
|
||
|
|
resp, err = pki.CBRead(b, s, "issuer/default/crl")
|
||
|
|
require.NoError(t, err)
|
||
|
|
intCRL := resp.Data["crl"].(string) + "\n"
|
||
|
|
|
||
|
|
// No need to fetch root Delta CRL as we've not revoked anything on it.
|
||
|
|
resp, err = pki.CBRead(b, s, "issuer/default/crl/delta")
|
||
|
|
require.NoError(t, err)
|
||
|
|
deltaCRL := resp.Data["crl"].(string) + "\n"
|
||
|
|
|
||
|
|
crls := rootCRL + intCRL + deltaCRL
|
||
|
|
|
||
|
|
cleanup, host, port, networkName, networkAddr, networkPort := buildNginxContainer(t, rootCert, crls, fullChain, leafPrivateKey)
|
||
|
|
defer cleanup()
|
||
|
|
|
||
|
|
if host != "127.0.0.1" && host != "::1" && strings.HasPrefix(host, containerName) {
|
||
|
|
t.Logf("Assuming %v:%v is a container name rather than localhost reference.", host, port)
|
||
|
|
host = uniqueHostname
|
||
|
|
port = networkPort
|
||
|
|
}
|
||
|
|
|
||
|
|
localBase := "https://" + host + ":" + strconv.Itoa(port)
|
||
|
|
localURL := localBase + "/index.html"
|
||
|
|
localProtectedURL := localBase + "/protected.html"
|
||
|
|
containerBase := "https://" + uniqueHostname + ":" + strconv.Itoa(networkPort)
|
||
|
|
containerURL := containerBase + "/index.html"
|
||
|
|
containerProtectedURL := containerBase + "/protected.html"
|
||
|
|
|
||
|
|
t.Logf("Spawned nginx container:\nhost: %v\nport: %v\nnetworkName: %v\nnetworkAddr: %v\nnetworkPort: %v\nlocalURL: %v\ncontainerURL: %v\n", host, port, networkName, networkAddr, networkPort, localBase, containerBase)
|
||
|
|
|
||
|
|
// Ensure we can connect with Go. We do our checks for revocation here,
|
||
|
|
// as this behavior is server-controlled and shouldn't matter based on
|
||
|
|
// client type.
|
||
|
|
CheckWithGo(t, rootCert, "", nil, "", host, port, networkAddr, networkPort, localURL, unprotectedFile, false)
|
||
|
|
CheckWithGo(t, rootCert, "", nil, "", host, port, networkAddr, networkPort, localProtectedURL, failureIndicator, true)
|
||
|
|
CheckWithGo(t, rootCert, clientCert, clientCAChain, clientKey, host, port, networkAddr, networkPort, localProtectedURL, protectedFile, false)
|
||
|
|
CheckWithGo(t, rootCert, revokedCert, revokedCAChain, revokedKey, host, port, networkAddr, networkPort, localProtectedURL, protectedFile, true)
|
||
|
|
// CheckWithGo(t, rootCert, deltaCert, deltaCAChain, deltaKey, host, port, networkAddr, networkPort, localProtectedURL, protectedFile, true)
|
||
|
|
|
||
|
|
// Ensure we can connect with wget/curl.
|
||
|
|
CheckWithClients(t, networkName, networkAddr, containerURL, rootCert, "", "")
|
||
|
|
CheckWithClients(t, networkName, networkAddr, containerProtectedURL, clientTrustChain, clientWireChain, clientKey)
|
||
|
|
|
||
|
|
// Ensure OpenSSL will validate the delta CRL by revoking our server leaf
|
||
|
|
// and then using it with wget2. This will land on the intermediate's
|
||
|
|
// Delta CRL.
|
||
|
|
_, err = pki.CBWrite(b, s, "revoke", map[string]interface{}{
|
||
|
|
"certificate": leafCert,
|
||
|
|
})
|
||
|
|
require.NoError(t, err)
|
||
|
|
_, err = pki.CBRead(b, s, "crl/rotate-delta")
|
||
|
|
require.NoError(t, err)
|
||
|
|
resp, err = pki.CBRead(b, s, "issuer/default/crl/delta")
|
||
|
|
require.NoError(t, err)
|
||
|
|
deltaCRL = resp.Data["crl"].(string) + "\n"
|
||
|
|
crls = rootCRL + intCRL + deltaCRL
|
||
|
|
|
||
|
|
CheckDeltaCRL(t, networkName, networkAddr, containerURL, rootCert, crls)
|
||
|
|
}
|
||
|
|
|
||
|
|
func Test_NginxRSAPure(t *testing.T) {
|
||
|
|
t.Parallel()
|
||
|
|
RunNginxRootTest(t, "rsa", 2048, false, "rsa", 2048, false)
|
||
|
|
}
|
||
|
|
|
||
|
|
func Test_NginxRSAPurePSS(t *testing.T) {
|
||
|
|
t.Parallel()
|
||
|
|
RunNginxRootTest(t, "rsa", 2048, false, "rsa", 2048, true)
|
||
|
|
}
|
||
|
|
|
||
|
|
func Test_NginxRSAPSSPure(t *testing.T) {
|
||
|
|
t.Parallel()
|
||
|
|
RunNginxRootTest(t, "rsa", 2048, true, "rsa", 2048, false)
|
||
|
|
}
|
||
|
|
|
||
|
|
func Test_NginxRSAPSSPurePSS(t *testing.T) {
|
||
|
|
t.Parallel()
|
||
|
|
RunNginxRootTest(t, "rsa", 2048, true, "rsa", 2048, true)
|
||
|
|
}
|
||
|
|
|
||
|
|
func Test_NginxECDSA256Pure(t *testing.T) {
|
||
|
|
t.Parallel()
|
||
|
|
RunNginxRootTest(t, "ec", 256, false, "ec", 256, false)
|
||
|
|
}
|
||
|
|
|
||
|
|
func Test_NginxECDSAHybrid(t *testing.T) {
|
||
|
|
t.Parallel()
|
||
|
|
RunNginxRootTest(t, "ec", 256, false, "rsa", 2048, false)
|
||
|
|
}
|
||
|
|
|
||
|
|
func Test_NginxECDSAHybridPSS(t *testing.T) {
|
||
|
|
t.Parallel()
|
||
|
|
RunNginxRootTest(t, "ec", 256, false, "rsa", 2048, true)
|
||
|
|
}
|
||
|
|
|
||
|
|
func Test_NginxRSAHybrid(t *testing.T) {
|
||
|
|
t.Parallel()
|
||
|
|
RunNginxRootTest(t, "rsa", 2048, false, "ec", 256, false)
|
||
|
|
}
|
||
|
|
|
||
|
|
func Test_NginxRSAPSSHybrid(t *testing.T) {
|
||
|
|
t.Parallel()
|
||
|
|
RunNginxRootTest(t, "rsa", 2048, true, "ec", 256, false)
|
||
|
|
}
|